1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * Handle firewalling
4 * Linux ethernet bridge
5 *
6 * Authors:
7 * Lennert Buytenhek <buytenh@gnu.org>
8 * Bart De Schuymer <bdschuym@pandora.be>
9 *
10 * Lennert dedicates this file to Kerstin Wurdinger.
11 */
12
13#include <linux/module.h>
14#include <linux/kernel.h>
15#include <linux/slab.h>
16#include <linux/ip.h>
17#include <linux/netdevice.h>
18#include <linux/skbuff.h>
19#include <linux/if_arp.h>
20#include <linux/if_ether.h>
21#include <linux/if_vlan.h>
22#include <linux/if_pppox.h>
23#include <linux/ppp_defs.h>
24#include <linux/netfilter_bridge.h>
25#include <linux/netfilter_ipv4.h>
26#include <linux/netfilter_ipv6.h>
27#include <linux/netfilter_arp.h>
28#include <linux/in_route.h>
29#include <linux/inetdevice.h>
30
31#include <net/ip.h>
32#include <net/ipv6.h>
33#include <net/addrconf.h>
34#include <net/route.h>
35#include <net/netfilter/br_netfilter.h>
36
37#include <linux/uaccess.h>
38#include "br_private.h"
39#ifdef CONFIG_SYSCTL
40#include <linux/sysctl.h>
41#endif
42
43int br_validate_ipv6(struct net *net, struct sk_buff *skb)
44{
45 const struct ipv6hdr *hdr;
46 struct inet6_dev *idev = __in6_dev_get(dev: skb->dev);
47 u32 pkt_len;
48 u8 ip6h_len = sizeof(struct ipv6hdr);
49
50 if (!pskb_may_pull(skb, len: ip6h_len))
51 goto inhdr_error;
52
53 if (skb->len < ip6h_len)
54 goto drop;
55
56 hdr = ipv6_hdr(skb);
57
58 if (hdr->version != 6)
59 goto inhdr_error;
60
61 pkt_len = ntohs(hdr->payload_len);
62 if (hdr->nexthdr == NEXTHDR_HOP && nf_ip6_check_hbh_len(skb, plen: &pkt_len))
63 goto drop;
64
65 if (pkt_len + ip6h_len > skb->len) {
66 __IP6_INC_STATS(net, idev,
67 IPSTATS_MIB_INTRUNCATEDPKTS);
68 goto drop;
69 }
70 if (pskb_trim_rcsum(skb, len: pkt_len + ip6h_len)) {
71 __IP6_INC_STATS(net, idev,
72 IPSTATS_MIB_INDISCARDS);
73 goto drop;
74 }
75
76 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
77 /* No IP options in IPv6 header; however it should be
78 * checked if some next headers need special treatment
79 */
80 return 0;
81
82inhdr_error:
83 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
84drop:
85 return -1;
86}
87
88static inline bool
89br_nf_ipv6_daddr_was_changed(const struct sk_buff *skb,
90 const struct nf_bridge_info *nf_bridge)
91{
92 return memcmp(p: &nf_bridge->ipv6_daddr, q: &ipv6_hdr(skb)->daddr,
93 size: sizeof(ipv6_hdr(skb)->daddr)) != 0;
94}
95
96/* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables
97 * PREROUTING and continue the bridge PRE_ROUTING hook. See comment
98 * for br_nf_pre_routing_finish(), same logic is used here but
99 * equivalent IPv6 function ip6_route_input() called indirectly.
100 */
101static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struct sk_buff *skb)
102{
103 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
104 struct rtable *rt;
105 struct net_device *dev = skb->dev, *br_indev;
106 const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
107
108 br_indev = nf_bridge_get_physindev(skb, net);
109 if (!br_indev) {
110 kfree_skb(skb);
111 return 0;
112 }
113
114 nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;
115
116 if (nf_bridge->pkt_otherhost) {
117 skb->pkt_type = PACKET_OTHERHOST;
118 nf_bridge->pkt_otherhost = false;
119 }
120 nf_bridge->in_prerouting = 0;
121 if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) {
122 skb_dst_drop(skb);
123 v6ops->route_input(skb);
124
125 if (skb_dst(skb)->error) {
126 kfree_skb(skb);
127 return 0;
128 }
129
130 if (skb_dst(skb)->dev == dev) {
131 skb->dev = br_indev;
132 nf_bridge_update_protocol(skb);
133 nf_bridge_push_encap_header(skb);
134 br_nf_hook_thresh(NF_BR_PRE_ROUTING,
135 net, sk, skb, indev: skb->dev, NULL,
136 okfn: br_nf_pre_routing_finish_bridge);
137 return 0;
138 }
139 ether_addr_copy(dst: eth_hdr(skb)->h_dest, src: dev->dev_addr);
140 skb->pkt_type = PACKET_HOST;
141 } else {
142 rt = bridge_parent_rtable(dev: br_indev);
143 if (!rt) {
144 kfree_skb(skb);
145 return 0;
146 }
147 skb_dst_drop(skb);
148 skb_dst_set_noref(skb, dst: &rt->dst);
149 }
150
151 skb->dev = br_indev;
152 nf_bridge_update_protocol(skb);
153 nf_bridge_push_encap_header(skb);
154 br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb,
155 indev: skb->dev, NULL, okfn: br_handle_frame_finish);
156
157 return 0;
158}
159
160/* Replicate the checks that IPv6 does on packet reception and pass the packet
161 * to ip6tables.
162 */
163unsigned int br_nf_pre_routing_ipv6(void *priv,
164 struct sk_buff *skb,
165 const struct nf_hook_state *state)
166{
167 struct nf_bridge_info *nf_bridge;
168
169 if (br_validate_ipv6(net: state->net, skb))
170 return NF_DROP_REASON(skb, reason: SKB_DROP_REASON_IP_INHDR, err: 0);
171
172 nf_bridge = nf_bridge_alloc(skb);
173 if (!nf_bridge)
174 return NF_DROP_REASON(skb, reason: SKB_DROP_REASON_NOMEM, err: 0);
175 if (!setup_pre_routing(skb, net: state->net))
176 return NF_DROP_REASON(skb, reason: SKB_DROP_REASON_DEV_READY, err: 0);
177
178 nf_bridge = nf_bridge_info_get(skb);
179 nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr;
180
181 skb->protocol = htons(ETH_P_IPV6);
182 skb->transport_header = skb->network_header + sizeof(struct ipv6hdr);
183
184 NF_HOOK(pf: NFPROTO_IPV6, hook: NF_INET_PRE_ROUTING, net: state->net, sk: state->sk, skb,
185 in: skb->dev, NULL,
186 okfn: br_nf_pre_routing_finish_ipv6);
187
188 return NF_STOLEN;
189}
190

source code of linux/net/bridge/br_netfilter_ipv6.c